CN107094207B - A kind of automatic testing method and its automatic detection device of traffic indicator exception - Google Patents

Abstract

The invention discloses an automatic detection method for traffic index abnormality, an automatic detection device, terminal equipment, and a storage medium. The abnormal automatic detection method of the traffic index comprises the following steps: collecting the traffic index data of each business line; storing the collected traffic index data of each business line; storing the historical traffic index data of each business line , forming a plurality of historical traffic index data fragments according to the time dimension, and generating a jitter rising threshold and a jitter falling threshold for each of the historical traffic index data fragments; according to the history corresponding to the traffic index data to be detected The jitter rising threshold and the jitter falling threshold of the traffic index data fragmentation determine whether the traffic index data is abnormal data; when the traffic index data is detected as abnormal data, according to the business line where the traffic index data is located After the alarm content is processed, notify the responsible object of the business line.

Description

An automatic detection method and automatic detection device for traffic index abnormality

technical field

The invention relates to the field of communication technology, in particular to an automatic detection method for abnormal traffic indicators in a call center, an automatic detection device for abnormal traffic indicators, terminal equipment, and a storage medium.

Background technique

The existing call center monitoring platform monitors the traffic index data of each business line, but the monitoring method is generally to manually configure each monitoring item one by one. At present, with the rapid development of their business, some companies with large-scale call centers have exponentially increased the number of call center systems and business lines that need to be monitored. This traditional traffic index data monitoring method can no longer meet the needs of users. need.

Specifically, on the one hand, because the curves of each business line are diversified and do not have uniform characteristics, if tens of thousands of monitoring items are still manually configured one by one, the workload will be huge and the efficiency will be extremely low, and a lot of time will be wasted. Labor costs; and the real-time and accuracy of manual configuration cannot be guaranteed, which also has a great impact on the timeliness of subsequent processing.

On the other hand, each business line of the call center is affected by various objective factors, resulting in more false notifications. For example, some business curves with special time changes (such as holidays or flight changes) often cause large jitter of traffic index data due to non-business system failures during this special time, resulting in more false alarms. However, the current monitoring methods cannot effectively filter these false alarms, which also has a great impact on the accuracy of monitoring.

Contents of the invention

Aiming at the defects in the prior art, the object of the present invention is to provide an automatic detection method and an automatic detection device for abnormal traffic indicators. The automatic detection method for the abnormality of the traffic index can reduce the labor cost of manual detection, improve efficiency, and can also ensure the real-time performance, accuracy and timeliness of detection.

According to one aspect of the present invention, an automatic detection method for traffic index abnormality is provided, and the automatic detection method for traffic index abnormality includes the following steps: collecting traffic index data of each business line; storing the collected traffic index data of each business line Traffic index data; the stored historical traffic index data of each business line is formed into a plurality of historical traffic index data fragments according to the time dimension, and the jitter rising threshold value of each of the historical traffic index data fragments is generated and the jitter drop threshold; according to the jitter rise threshold and the jitter drop threshold of the historical traffic index data fragmentation corresponding to the traffic index data to be detected, it is judged whether the traffic index data is abnormal data; when the traffic index data When it is detected as abnormal data, after processing according to the alarm content of the business line where the traffic index data is located, the responsible object of the business line is notified.

Preferably, in the step of forming a plurality of historical traffic index data fragments, and generating the jitter rising threshold and jitter falling threshold of each of the historical traffic index data fragments, the following steps are further included: selecting the All historical traffic index data of each business line; divide all historical traffic index data of each selected business line evenly in time order to form multiple historical traffic index data fragments; obtain each historical traffic The jitter value between the various historical traffic index data in the index data slice, and generate the jitter rising threshold and the jitter falling threshold of the historical traffic index data slice.

Preferably, when the plurality of historical traffic index data in the historical traffic index data fragments are normally distributed, in the step of generating the jitter rising threshold and the jitter falling threshold of the historical traffic index data fragments It also includes the steps of: removing a plurality of historical traffic index data with the largest numerical value and a plurality of historical traffic index data with the smallest numerical value in the historical traffic index data fragmentation; The jitter rising threshold and the jitter falling threshold generated by the historical traffic index data, and the compensated jitter rising threshold and the jitter falling threshold are respectively used as the jitter rising threshold and the jitter falling threshold of the historical traffic index data fragmentation.

Preferably, a plurality of historical traffic index data with the largest value and a plurality of historical traffic index data with the smallest value in the historical traffic index data slice are respectively eliminated at a ratio of 12.5%.

Preferably, the jitter up threshold and the jitter down threshold generated by each historical traffic index data retained in the historical traffic index data slice are compensated at a ratio of 30%.

Preferably, the first period of time is 1 month or 2 months.

Preferably, the step of judging whether the traffic index data is abnormal data also includes the following steps: saving the traffic index data to be detected and a plurality of continuous traffic index data in its vicinity to form a traffic index to be detected Data fragmentation; obtain the jitter value between the various traffic index data in the traffic index data fragment to be detected; obtain the corresponding service line according to the business line and the time period where the traffic index data to be detected belongs The jitter rising threshold and the jitter falling threshold of the historical traffic index data fragment; when the continuous multiple jitter values in the traffic index data fragment to be detected exceed the first reasonable value range, the traffic to be detected Index data fragmentation carries out local trend check, calculates the average value, and selects a second reasonable value range according to the jitter range of the traffic index data fragmentation to be detected, wherein, the maximum value of the first reasonable value range is greater than the historical traffic The jitter rising threshold of traffic index data fragmentation, the minimum value is less than the descending threshold of historical traffic index data fragmentation; If the traffic index data to be detected exceeds the second reasonable value range, the traffic index data to be detected regarded as abnormal data.

Preferably, the local trend check is carried out to the traffic index data fragmentation to be detected, the average value is calculated, and the condition for selecting a second reasonable data range according to the jitter range of the traffic index data fragmentation to be detected is: Two consecutive jitter values exceed twice the jitter up threshold or jitter down threshold of the historical traffic index data slice respectively; or three consecutive jitter values exceed the jitter up threshold or the jitter down threshold of the historical traffic index data shard respectively 1.8 times.

Preferably, the total number of the saved traffic index data and the plurality of traffic index data near the traffic index data to be detected and the historical traffic index data fragmentation of the service line corresponding to the traffic index data to be detected The total number of historical traffic index data in the same.

Preferably, each traffic index data collected and stored is the sum or average value of all data within a second period.

Preferably, in each service line, the second time period selected for each traffic index data collected and stored is the same, and the second time period is any one of 1 minute, 2 minutes, 5 minutes or 30 minutes.

According to another aspect of the present invention, there is also provided an automatic detection device for traffic index abnormality, the automatic detection device for traffic index abnormality includes: a data acquisition module, used to collect traffic index data of each business line; module, connected with the data collection module, used to store the collected traffic index data of each business line; the jitter analysis module, connected with the storage module, used to store the historical traffic data of each business line According to the traffic index data, a plurality of historical traffic index data fragments are formed according to the time dimension, and the jitter rising threshold and the jitter falling threshold of each of the historical traffic index data fragments are generated; the jitter detection module is respectively connected with the jitter analysis The module is connected with the acquisition module, and is used to determine whether the traffic index data is abnormal data according to the jitter rising threshold and the jitter falling threshold of the historical traffic index data fragmentation corresponding to the traffic index data to be detected; An alarm module, connected to the jitter detection module, used to notify the responsible person of the business line after processing according to the alarm content of the business line where the traffic index data is located when the traffic index data is detected as abnormal data object.

Preferably, the jitter analysis module includes: a data selection unit for selecting all historical traffic index data of each service line in the first period; a data fragmentation unit connected with the data selection unit for All the selected historical traffic index data of each business line are evenly divided according to time order to form a plurality of historical traffic index data fragments; the threshold calculation unit is connected with the data fragmentation unit for obtaining each The jitter value between each historical traffic index data in a historical traffic index data fragment, and generate the jitter rising threshold and jitter falling threshold of the historical traffic index data fragment.

Preferably, when the multiple historical traffic index data in the historical traffic index data fragment formed by the data fragmentation unit are normally distributed, the threshold value calculation unit further includes: a data elimination unit, which eliminates the historical traffic index data A plurality of historical traffic index data with the largest numerical value and a plurality of historical traffic index data with the smallest numerical value in the fragmentation of the traffic index data; and a data correction unit connected with the data removal unit for compensating the historical traffic The jitter rising threshold and the jitter falling threshold generated by each historical traffic index data retained in the indicator data fragment, and the compensated jitter rising threshold and the jitter falling threshold are respectively used as the jitter rising threshold of the historical traffic index data fragment and jitter drop thresholds.

Preferably, the jitter detection module includes: a local data storage unit, which is used to save the traffic index data to be detected and a plurality of continuous traffic index data in its vicinity, so as to form a piece of traffic index data to be detected; the jitter The value calculation unit is connected with the local data storage unit, and is used to obtain the jitter value between each traffic index data in the traffic index data slice to be detected; the jitter threshold acquisition unit is connected with the local data storage unit Connected, the jitter rising threshold and the jitter falling threshold for obtaining the corresponding historical traffic index data fragmentation according to the business line to which the traffic index data to be detected belong and the time period; the jitter rule acquisition unit, It is connected with the local data storage unit, the local data storage unit and the jitter value calculation unit, and is used for when the continuous multiple jitter values in the traffic index data fragment to be detected exceed the first reasonable value range , the local trend check is carried out on the traffic index data fragmentation to be detected, the average value is calculated, and a second reasonable value range is selected according to the jitter range of the traffic index data fragmentation to be detected, wherein, the first The maximum value of the reasonable value range is greater than the jitter rising threshold of the historical traffic index data fragmentation, and the minimum value is less than the descending threshold of the historical traffic index data fragmentation; the detection unit is connected with the described jitter rule acquisition unit, when the to-be-detected If the traffic index data exceeds the second reasonable value range, the traffic index data to be detected is regarded as abnormal data.

According to still another aspect of the present invention, there is also provided a terminal device, including: a processor; and a memory storing a program, wherein, when the processor executes the program, the following operations are performed: collect the words of each business line Store the collected traffic index data of each business line; form multiple historical traffic index data fragments according to the time dimension by storing the historical traffic index data of each business line, and generate each Describe the jitter rising threshold and the jitter falling threshold of the historical traffic index data fragmentation; judge the traffic index according to the jitter rising threshold and the jitter falling threshold of the historical traffic index data fragmentation corresponding to the traffic index data to be detected Whether the data is abnormal data; when the traffic index data is detected as abnormal data, after processing according to the alarm content of the business line where the traffic index data is located, notify the responsible object of the business line.

According to still another aspect of the present invention, a storage medium is also provided for storing a program, wherein, when the program is executed, the terminal equipment performs the following operations: collect the traffic index data of each service line; store the collected The traffic index data of each business line; the stored historical traffic index data of each business line is formed into a plurality of historical traffic index data fragments according to the time dimension, and each of the historical traffic index data fragments is generated The jitter rising threshold and the jitter falling threshold; according to the jitter rising threshold and the jitter falling threshold of the historical traffic index data fragmentation corresponding to the traffic index data to be detected, it is judged whether the traffic index data is abnormal data; when the When the traffic index data is detected as abnormal data, after processing according to the alarm content of the business line where the traffic index data is located, the responsible object of the business line is notified.

Compared with the prior art, the embodiment of the present invention provides an automatic detection method for abnormal traffic indicators and an automatic detection device for abnormal traffic indicators by forming multiple data according to the time dimension by storing the historical traffic indicator data of each business line. historical traffic index data fragments, and generate the jitter rising threshold and jitter falling threshold of each historical traffic index data fragment, according to the historical traffic index data corresponding to the traffic index data to be detected The jitter rising threshold and jitter falling threshold of the chip are used to judge whether the traffic index data is abnormal data. Furthermore, the automatic detection method for abnormal traffic indicators can greatly reduce the labor cost of using manual detection in the existing detection methods, improve efficiency, and the real-time and accuracy are effectively guaranteed, which plays a role in the timeliness of subsequent processing. significant role.

In addition, the automatic detection method for traffic index abnormality and the automatic detection device for traffic index abnormality also form a waiting list by saving the traffic index data to be detected and a plurality of traffic index data near the traffic index data to be detected. The detected traffic index data fragmentation, when the continuous multiple jitter values in the traffic index data fragments to be detected exceed the first reasonable value range, the local trend verification is performed on the traffic index data fragments to be detected , calculate the average value, and select a second reasonable value range according to the jitter range of the traffic index data fragmentation to be detected, and only when the traffic index data to be detected exceeds the second reasonable value range, it is regarded as abnormal detection Success, therefore, it has an obvious and effective detection effect on the traffic index data with large jitter abnormalities, and can more effectively reduce the false alarm phenomenon caused by the drop after jitter.

Description of drawings

Other characteristics, objects and advantages of the present invention will become more apparent by reading the detailed description of non-limiting embodiments made with reference to the following drawings:

Fig. 1 is the flow chart of a kind of automatic detection method of traffic indicator abnormality of an embodiment of the present invention;

Fig. 2 is a flow chart of each step of forming historical traffic index data fragmentation, generating a jitter rising threshold and a jitter falling threshold in an automatic detection method for traffic index anomalies according to an embodiment of the present invention;

Fig. 3 is a flowchart of various steps of generating a jitter rising threshold and a jitter falling threshold in an automatic detection method for abnormal traffic indicators according to an embodiment of the present invention.

Fig. 4 is a flowchart of each step of judging whether the traffic index data is abnormal data in the automatic detection method of traffic index abnormality according to an embodiment of the present invention; and

Fig. 5 is a schematic structural diagram of an automatic detection device for abnormal traffic indicators according to an embodiment of the present invention.

Detailed ways

Example embodiments will now be described more fully with reference to the accompanying drawings. Example embodiments may, however, be embodied in many forms and should not be construed as limited to the embodiments set forth herein; rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the concept of example embodiments to those skilled in the art. The same reference numerals denote the same or similar structures in the drawings, and thus their repeated descriptions will be omitted.

The described features, structures, or characteristics may be combined in any suitable manner in one or more embodiments. In the following description, numerous specific details are provided in order to give a thorough understanding of embodiments of the invention. However, those skilled in the art will appreciate that the technical solutions of the present invention may be practiced without one or more of the specific details, or with other methods, components, materials, and the like. In some instances, well-known structures, materials, or operations are not shown or described in detail to avoid obscuring the invention.

Furthermore, the drawings are merely schematic illustrations of the present disclosure and are not necessarily drawn to scale. The same reference numerals in the drawings denote the same or similar parts, and thus repeated descriptions thereof will be omitted. Some of the block diagrams shown in the drawings are functional entities and do not necessarily correspond to physically or logically separate entities. These functional entities may be implemented in software, or in one or more hardware modules or integrated circuits, or in different network and/or processor means and/or microcontroller means.

According to the gist of the present invention, a method for automatically detecting traffic index abnormalities of the present invention includes the following steps: collecting the traffic index data of each business line; storing the collected traffic index data of each business line; storing the stored traffic index data; The historical traffic index data of each line of business forms a plurality of historical traffic index data fragments according to the time dimension, and generates the jitter rising threshold and the jitter falling threshold of each described historical traffic index data fragmentation; The jitter rising threshold and the jitter falling threshold of the historical traffic index data fragmentation corresponding to the detected traffic index data, judge whether the traffic index data is abnormal data; when the traffic index data is detected as abnormal data, according to After processing the alarm content of the business line where the traffic index data is located, the responsible object of the business line is notified.

The technical content of the present invention will be further described below in conjunction with the accompanying drawings and embodiments.

Please refer to FIG. 1 , which shows a flow chart of an automatic detection method for abnormal traffic indicators according to an embodiment of the present invention. As shown in Figure 1, in an embodiment of the present invention, the automatic detection method of described traffic indicator abnormality comprises the following steps:

Step S10: collecting traffic index data of each service line. Specifically, in this step, the traffic index data (such as total traffic volume, success rate, etc.) , send the data to the message queue. Subsequently, these data are sent to other functional modules for storage and detection.

Step S20: storing the collected traffic index data of each business line. In this step, all the collected data along the time series are classified and stored according to different time periods through aggregation calculation. Specifically, each stored traffic index data is the sum or average value of all data in a second time period. In each business line, the second time period selected for each stored traffic index data is the same, and the second time period selected for the traffic index data may be different among various business lines. Wherein, the second period of time may be any one of 1 minute, 2 minutes, 5 minutes or 30 minutes. For example, for some business lines, the data of each traffic index stored can be the sum of all data in each minute or the average value of all data in each minute in time series; for other business lines In other words, the stored data of each service indicator can also be the sum of all the data in every 5 minutes or the average value of all the data in every 5 minutes on the time series. Furthermore, the traffic index data of each of the above business lines is processed and stored in an open-source and reliable enterprise-level storage system. The storage system needs to support various ways of obtaining data so that the data can be used.

Step S30: Form a plurality of historical traffic index data fragments according to the time dimension of the stored historical traffic index data of each business line, and generate the jitter rising threshold and jitter of each historical traffic index data fragment drop threshold. In this step, it can be understood as generating a jitter rule for judging whether the traffic index data is abnormal data in each business line.

Specifically, please refer to FIG. 2, which shows the steps of forming historical traffic index data fragmentation, generating jitter rising threshold and jitter falling threshold in the automatic detection method of traffic index abnormality according to an embodiment of the present invention flow chart. As shown in Figure 2, the above step S30 also includes the following steps:

Step S301: Select all historical traffic index data of each service line in the first period. Optionally, the first period is 1 month or 2 months. As an example, if the second time period is selected as 1 minute (that is, each traffic index data stored can be along the sum or average value of all data in each minute on the time series) as an example, then in this step , select the historical traffic index data per minute within 2 months from all the historical traffic index data of each business line stored above, and use the historical traffic index data per minute within 2 months as a follow-up The basis for generating the jitter rising threshold and jitter falling threshold. It should be noted that the first period of time can be changed according to the user's requirement for data accuracy, for example, 3 months or 4 months of historical traffic index data can also be selected, which will not be repeated here.

Step S302: Evenly divide all historical traffic index data of each selected business line according to time order to form multiple historical traffic index data fragments. Specifically, taking a business line where the second time period is selected as 1 minute (that is, each traffic index data stored can be along the sum or average value of all data in each minute on the time series) as an example, you can All historical traffic index data in the first period (such as the above-mentioned 2 months) are divided according to time order with every 10 data as a historical traffic index data fragment (that is, each historical traffic index data fragment slice includes historical traffic index data within 10 minutes), and then, assuming that the monitored business line is within 24 hours a day, all historical traffic index data of the business line for one day can be divided into 144 historical traffic index data Fragmentation. It should be noted that, in other embodiments of the present invention, the quantity of historical traffic index data included in each historical traffic index data fragment can be changed, and in this embodiment only every 10 historical The traffic index data is taken as an example, which will not be repeated here.

Step S303: Obtain the jitter value between the historical traffic index data in each historical traffic index data segment, and generate the jitter rising threshold and the jitter falling threshold of the historical traffic index data segment. Specifically, the jitter value between each historical traffic index data refers to along the time series, between two adjacent historical traffic index data, along the time series, the latter value minus the previous value (such as the current value minus the previous value). Furthermore, the above-mentioned 10 pieces of data are used as a piece of historical traffic index data, including 9 jitter values. The jitter value of the historical traffic index data fragment includes rising and falling values. The jitter rise value refers to the value that the difference between the latter value minus the previous value is a positive number (that is, the value of the latter historical traffic index data is greater than the value of the previous historical traffic index data); correspondingly, the jitter drop value It means that the difference between the latter value minus the previous value is a negative value (that is, the value of the latter historical traffic index data is smaller than the value of the previous historical traffic index data). Furthermore, the jitter rising threshold may be the maximum value of all the jitter rising values in the historical traffic index data fragments of all the same time periods in the first period; and the jitter falling threshold may be the maximum value of all the same time periods in the first period. The minimum value among all the jitter reduction values of the historical traffic index data slice. Take the above-mentioned business line where the second time period is selected as 1 minute (that is, each traffic index data stored can be along the sum or average value of all data in each minute on the time series) as an example, assuming that the time sequence is All the historical traffic index data within 2 months are divided into 10 data as a historical traffic index data fragmentation, then the data of one day can be divided into 144 pieces, which are marked as 0-143 respectively; among them, the first Slice 0 is the fragmentation of historical traffic indicator data during the period of 0:00-0:10 every day, including 60 pieces of slice 0 in 2 months; slice 1 is the history of the period of 0:10-0:20 every day Traffic index data fragmentation includes 60 first slices in 2 months, and so on. Therefore, for the fragmentation of historical traffic index data in the period from 0:00 to 0:10, the jitter rising threshold is the maximum value of all jitter rising values in the 60th slice, and the jitter falling threshold is 60 The minimum value of all jitter reduction values in slice 0.

Further, please refer to FIG. 3 , which shows a flow chart of steps of generating a jitter rising threshold and a jitter falling threshold in an automatic detection method for abnormal traffic indicators according to an embodiment of the present invention. Specifically, in the embodiment shown in FIG. 2 , among all the historical traffic index data fragments divided by each business line in step S302 above, when multiple historical traffic index data fragments in any one historical traffic index data fragment When the traffic index data is normally distributed, then as shown in Figure 3, for the fragmentation of the historical traffic index data, the steps of generating the jitter rising threshold and the jitter falling threshold also include the following steps:

Step S3031: Eliminate a plurality of historical traffic index data with the largest value and a plurality of historical traffic index data with the smallest value in the historical traffic index data slice. Optionally, a plurality of historical traffic index data with the largest values and a plurality of historical traffic index data with the smallest values in the historical traffic index data slice are respectively eliminated at a ratio of 12.5%. For example, in an embodiment where every 16 pieces of data are used as a piece of historical traffic indicator data, the two largest values and the two smallest values among the 16 pieces of data can be eliminated. Or take the 600 pieces of data in the historical traffic indicator data fragment formed in the same time period within 2 months (such as the time period of 0:00-0:10 every day) as an example, then the largest 75% of the 600 pieces of data can be eliminated. values and the minimum 75 values, which will not be described here.

Step S3032: Compensate the jitter up threshold and jitter down threshold generated by each historical traffic index data retained in the historical traffic index data slice, and use the compensated jitter up threshold and jitter down threshold respectively as the historical traffic The jitter up threshold and jitter down threshold for metric data sharding. Optionally, the jitter up threshold and the jitter down threshold generated by each historical traffic index data retained in the historical traffic index data slice are compensated at a ratio of 30%. Specifically, if every 16 pieces of data are used as an example of a historical traffic index data fragmentation, after removing the two largest values and the two smallest values, the 12 historical traffic indicators are calculated from the remaining 12 data. The jitter rising threshold and the jitter falling threshold generated by the traffic index data, and the jitter rising threshold and the jitter falling threshold generated by the 12 historical traffic index data are compensated, for example, when the 12 historical traffic index data are generated On the basis of the jitter rising threshold value, add 30% of this value as the jitter rising threshold value in the finally generated historical traffic index data fragmentation; on the basis of the jitter falling threshold value generated by the 12 historical traffic index data Subtracting 30% of this value is used as the jitter reduction threshold in the finally generated historical traffic index data slice. The above step S303 can eliminate abnormal data caused by faults in the historical traffic index data.

Step S40: Determine whether the traffic index data is abnormal data according to the jitter rising threshold and the jitter falling threshold of the historical traffic index data slice corresponding to the traffic index data to be detected. Please refer to FIG. 4 , which shows a flow chart of each step of judging whether the traffic index data is abnormal data in the method for automatically detecting abnormal traffic index according to an embodiment of the present invention. Specifically, the step of judging whether the traffic index data is abnormal data (ie step S40) also includes the following steps:

Step S401: Save the traffic index data to be detected and a plurality of consecutive traffic index data near the traffic index data to be detected to form a segment of the traffic index data to be detected. Optionally, the total number of the saved traffic index data and the plurality of traffic index data near the traffic index data to be detected is divided into the historical traffic index data of the service line corresponding to the traffic index data to be detected. The total number of historical traffic index data in the slice is the same. For example, 10 traffic index data close to the traffic index data to be detected may be saved along the time series to form a segment of the traffic index data to be detected for jitter detection.

Step S402: Obtain the jitter value between each traffic index data in the traffic index data segment to be detected. Specifically, in this step, the jitter value between each traffic index data in the traffic index data fragments to be detected formed above is calculated.

Step S403: Obtain the jitter up threshold and jitter down threshold of the corresponding historical traffic index data slice according to the service line to which the traffic index data to be detected belongs and the time period. Specifically, in this step, the corresponding historical traffic indicators are obtained according to the type of the business line to which the traffic indicator data to be detected belongs and the time period (for example, the specific time of day). The data is segmented, and the jitter up threshold and jitter down threshold of the corresponding historical traffic index data segment obtained according to the above step S30 are obtained. For example, the type of business line to which the traffic index data to be detected belongs and the time period is 0:00-0:10, then the corresponding historical traffic index data fragmentation is the above-mentioned 144 formed every day The 0th slice in the historical traffic indicator data slices of different time periods.

Step S404: When the multiple consecutive jitter values in the traffic index data fragment to be detected exceed the first reasonable value range, then perform a local trend check on the traffic index data fragment to be detected, the local The step of trend verification is to calculate the average value of the traffic index data fragments to be detected, and select a second reasonable value range according to the average value and the jitter range of the traffic index data fragments to be detected. Specifically, in an embodiment of the present invention, the condition for performing local trend verification on the traffic index data fragments to be detected may be: two consecutive jitter values respectively exceed the jitter rising thresholds of the historical traffic index data fragments Or twice the jitter drop threshold; or three consecutive jitter values exceeding 1.8 times the jitter rise threshold or jitter drop threshold of the historical traffic index data slice respectively. Wherein, the maximum value of the first reasonable value range is greater than the jitter rising threshold of the historical traffic index data slice, and the minimum value is smaller than the falling threshold of the historical traffic index data slice. The second reasonable value range is formed according to the calculated average value of the traffic index data fragmentation to be detected (calculation of the average value excludes rising points) and in combination with each jitter value in the traffic index data fragmentation to be detected. Determined by the jitter range, for example, according to each jitter value in the traffic index data fragmentation to be detected, determine the jitter maximum value and the jitter minimum value in the traffic index data fragmentation to be detected; in the second reasonable range The maximum value is the sum of the average value of the traffic index data fragments to be detected and the maximum jitter value thereof, and the minimum value in the second reasonable range is the average value of the traffic index data fragments to be detected and the minimum jitter sum of values. It should be noted that, among the historical traffic index data fragments to be detected, the number of jitter values and the first reasonable value range that continuously exceed the jitter rising threshold or the jitter falling threshold of the historical traffic index data fragments can be determined according to the actual The demand is adjusted; the second reasonable value can also be adjusted according to the actual demand. This step can effectively reduce false alarms caused by data fallback after abnormal data jitter occurs.

Step S405: If the traffic index data to be detected exceeds the second reasonable value range, the traffic index data to be detected is regarded as abnormal data. Specifically, if the traffic index data to be detected exceeds the second reasonable value range obtained in the above step S404, it is considered that the abnormality detection is successful, and further, the subsequent alarm step can be performed. If the traffic index data to be detected does not exceed the second reasonable value range, it is regarded as an abnormality detection failure, that is, the traffic index data to be detected is normal data, and then the next traffic index data can be jittered detection.

Step S50: If the traffic index data is detected as abnormal data, after processing according to the alarm content of the business line where the traffic index data is located, notify the responsible object of the business line. Among them, the content of the alarm is different according to different business lines and different detected traffic index data. For example, the content of the alarm can be that the total traffic volume of the business line for ticket booking is abnormal. The method of follow-up notification can be to notify the relevant business person in charge by sending an email notification or a short message.

In combination with the above-mentioned embodiments shown in FIG. 1 to FIG. 4 , the automatic detection method for abnormal traffic indicators provided by the embodiments of the present invention forms multiple historical traffic indicators according to the time dimension by storing the historical traffic indicator data of each business line. After the indicator data is fragmented and the jitter rising threshold and the jitter falling threshold of each said historical traffic index data fragment are generated, according to the jitter rising of the historical traffic index data fragment corresponding to the traffic index data to be detected Threshold and jitter drop threshold, to judge whether the traffic index data is abnormal data. Furthermore, the automatic detection method for abnormal traffic indicators can greatly reduce the labor cost of using manual detection in the existing detection methods, improve efficiency, and the real-time and accuracy are effectively guaranteed, which plays a role in the timeliness of subsequent processing. significant role.

In addition, in the automatic detection method of traffic index abnormality, a segment of traffic index data to be detected is formed by saving the traffic index data to be detected and a plurality of traffic index data near the traffic index data to be detected , when the multiple consecutive jitter values in the traffic index data fragment to be detected exceed the first reasonable value range, the local trend check is performed on the traffic index data fragment to be detected, the average value is calculated, and according to the The jitter range of the traffic index data fragmentation to be detected selects a second reasonable value range, and only when the traffic index data to be detected exceeds the second reasonable value range, it is considered as abnormal detection success. Therefore, for large The traffic index data with abnormal jitter has obvious and effective detection effect, and can more effectively reduce the false alarm phenomenon caused by the drop after jitter.

Furthermore, the present invention also provides an automatic detection device for traffic index abnormality. Please refer to FIG. 5 , which shows a schematic structural diagram of an automatic detection device for abnormal traffic indicators according to an embodiment of the present invention. The device for automatically detecting abnormal traffic indicators is mainly used to realize the automatic detection method for abnormal traffic indicators shown in FIGS. 1 to 4 above. In the embodiment shown in FIG. 5 , the device for automatically detecting abnormal traffic indicators includes: a data collection module 1 , a storage module 2 , a jitter analysis module 3 , a jitter detection module 4 and an alarm module 5 .

Specifically, the data collection module 1 is used to collect traffic index data of each service line.

The storage module 2 is connected with the data collection module 1 and used for storing the collected traffic index data of each business line.

The jitter analysis module 3 is connected with the storage module 2, and is used to form a plurality of historical traffic index data fragments according to the time dimension according to the historical traffic index data of each business line stored, and generate each of the historical traffic index data. The jitter up threshold and jitter down threshold for metric data sharding.

Specifically, the jitter analysis module 3 includes: a data selection unit 31 , a data slice unit 32 and a threshold calculation unit 33 . The data selection unit 31 is used to select all historical traffic index data of each service line in the first period. The data fragmentation unit 32 is connected to the data selection unit 31, and is used to evenly divide all historical traffic index data of each selected business line according to time order to form a plurality of historical traffic index data fragments. The threshold calculation unit 33 is connected with the data fragmentation unit 32, and is used to obtain the jitter value between each historical traffic index data in each historical traffic index data fragmentation, and generate the jitter of the historical traffic index data fragmentation Rising threshold and jitter falling threshold. Further, when the multiple historical traffic index data in the historical traffic index data fragment formed by the data fragmentation unit are normally distributed, the threshold calculation unit 33 may also include: a data elimination unit and a data correction unit . Wherein, the data elimination unit is configured to respectively eliminate a plurality of larger historical traffic index data and a plurality of smaller historical traffic index data in the historical traffic index data slice according to a first ratio. The data correction unit is connected with the data elimination unit, and is used for compensating the maximum value and the minimum value retained in the historical traffic index data slice with the second ratio, and the maximum value and minimum value in the compensated historical traffic index data slice. The value and the minimum value are respectively used as the jitter rising threshold and jitter falling threshold of the historical traffic index data slice.

The jitter detection module 4 is connected with the jitter analysis module 3 and the data acquisition module 1 respectively, and is used for judging the Whether the traffic index data is abnormal data. Specifically, the shake detection module 4 includes: a local data storage unit 41 , a shake value calculation unit 42 , a shake threshold acquisition unit 43 , a shake rule acquisition unit 44 and a detection unit 45 .

Wherein, the local data storage unit 41 is used for storing the traffic index data to be detected and multiple consecutive traffic index data in its vicinity, forming a segment of the traffic index data to be detected.

The jitter value calculation unit 42 is connected to the local data storage unit 41, and is used to obtain the jitter value between various traffic index data in the traffic index data segment to be detected.

The jitter threshold acquisition unit 43 is connected with the local data storage unit 41, and is used to obtain the jitter rising threshold and the jitter threshold of the corresponding historical traffic index data fragmentation according to the business line to which the traffic index data to be detected belongs and the time period. Jitter drop threshold.

The jitter rule acquisition unit 44 is connected with the local data storage unit 41, the jitter value calculation unit 42 and the jitter threshold acquisition unit 43, and is used for when the continuous multiple jitter values in the traffic index data slice to be detected exceed the first reasonable When the value range, the traffic index data fragmentation to be detected is carried out local trend verification, calculates the average value, and selects a second reasonable value range according to the jitter range of the traffic index data fragmentation to be detected, wherein, The maximum value of the first reasonable value range is greater than the jitter rising threshold of the historical traffic index data slice, and the minimum value is smaller than the falling threshold of the historical traffic index data slice.

The detection unit 45 is connected to the jitter rule acquisition unit 44, and when the traffic index data to be detected exceeds the second reasonable value range, the traffic index data to be detected is regarded as abnormal data.

The alarm module 5 is connected with the jitter detection module 4, and is used for notifying the responsible object of the business line after processing according to the alarm content of the service line where the traffic indicator data is located when the traffic index data is detected as abnormal data .

Further, the present invention also provides a terminal device. The terminal device may be, for example, a server, a computer, and other devices. The terminal device includes: a processor; and a memory storing a program, wherein, when the processor executes the program, the following operations are performed:

Collect the traffic index data of each business line;

Store the collected traffic index data of each business line;

Forming a plurality of historical traffic index data fragments according to the time dimension of the stored historical traffic index data of each business line, and generating a jitter rising threshold and a jitter falling threshold for each of the historical traffic index data fragments;

Judging whether the traffic index data is abnormal data according to the jitter rising threshold and the jitter falling threshold of the historical traffic index data fragmentation corresponding to the traffic index data to be detected;

When the traffic index data is detected as abnormal data, after processing according to the alarm content of the business line where the traffic index data is located, the responsible object of the business line is notified.

Further, the present invention also provides a storage medium. The storage medium may refer to a device such as a hard disk storage chip, and is used to store a program. When the program is executed, the terminal device executes the automatic detection method for abnormal traffic indicators shown in FIG. 1 above. Specifically, when the program is executed, the terminal device performs the following steps:

When the program is executed, the terminal device performs the following operations:

Collect the traffic index data of each business line;

Store the collected traffic index data of each business line;

Forming a plurality of historical traffic index data fragments according to the time dimension of the stored historical traffic index data of each business line, and generating a jitter rising threshold and a jitter falling threshold for each of the historical traffic index data fragments;

Judging whether the traffic index data is abnormal data according to the jitter rising threshold and the jitter falling threshold of the historical traffic index data fragmentation corresponding to the traffic index data to be detected;

When the traffic index data is detected as abnormal data, after processing according to the alarm content of the business line where the traffic index data is located, the responsible object of the business line is notified.

In summary, the embodiment of the present invention provides an automatic detection method for abnormal traffic indicators and an automatic detection device for abnormal traffic indicators by forming multiple historical traffic indicators according to the time dimension by storing the historical traffic indicator data of each business line. Traffic index data fragmentation, and after generating the jitter rising threshold and the jitter falling threshold of each described historical traffic index data fragmentation, according to the historical traffic index data fragmentation corresponding to the traffic index data to be detected The jitter rising threshold and the jitter falling threshold judge whether the traffic index data is abnormal data. Furthermore, the automatic detection method for abnormal traffic indicators can greatly reduce the labor cost of using manual detection in the existing detection methods, improve efficiency, and the real-time and accuracy are effectively guaranteed, which plays a role in the timeliness of subsequent processing. significant role.

In addition, the automatic detection method for traffic index abnormality and the automatic detection device for traffic index abnormality also form a waiting list by saving the traffic index data to be detected and a plurality of traffic index data near the traffic index data to be detected. The detected traffic index data fragmentation, when the continuous multiple jitter values in the traffic index data fragments to be detected exceed the first reasonable value range, the local trend verification is performed on the traffic index data fragments to be detected , calculate the average value, and select a second reasonable value range according to the jitter range of the traffic index data fragmentation to be detected, and only when the traffic index data to be detected exceeds the second reasonable value range, it is regarded as abnormal detection Success, therefore, it has an obvious and effective detection effect on the traffic index data with large jitter abnormalities, and can more effectively reduce the false alarm phenomenon caused by the drop after jitter.

Although the present invention has been disclosed above with optional embodiments, they are not intended to limit the present invention. Those skilled in the art to which the present invention belongs can make various changes and modifications without departing from the spirit and scope of the present invention. Therefore, the protection scope of the present invention should be determined by the scope defined in the claims.

Claims (15)

1. a kind of automatic detection method of traffic index abnormality, it is characterized in that, the automatic detection method of described traffic index abnormality comprises the steps: Collect the traffic index data of each business line; Store the collected traffic index data of each business line; Forming a plurality of historical traffic index data fragments according to the time dimension of the stored historical traffic index data of each business line, and generating a jitter rising threshold and a jitter falling threshold for each of the historical traffic index data fragments; Judging whether the traffic index data is abnormal data according to the jitter rising threshold and the jitter falling threshold of the historical traffic index data fragmentation corresponding to the traffic index data to be detected; When the traffic index data is detected as abnormal data, after processing according to the alarm content of the business line where the traffic index data is located, notify the responsible object of the business line; The step of judging whether the traffic index data is abnormal data also includes the following steps: saving the traffic index data to be detected and a plurality of continuous traffic index data in its vicinity to form a segment of the traffic index data to be detected; Obtain the jitter value between each traffic index data in the traffic index data fragment to be detected; According to the business line to which the traffic index data to be detected belongs and the time period, the jitter rising threshold and the jitter falling threshold of the corresponding historical traffic index data fragmentation are obtained; When the continuous multiple jitter values in the traffic index data fragments to be detected exceed the first reasonable value range, then the traffic index data fragments to be detected are checked for local trends, the average value is calculated, and according to The jitter range of the traffic index data fragmentation to be detected selects a second reasonable value range, wherein, the maximum value of the first reasonable value range is greater than the jitter rising threshold of the historical traffic index data fragmentation, and the minimum value is less than the historical traffic The falling threshold of indicator data sharding; If the traffic index data to be detected exceeds the second reasonable value range, the traffic index data to be detected is regarded as abnormal data. 2. the automatic detection method of traffic index as claimed in claim 1 is characterized in that, after forming a plurality of historical traffic index data fragments, and generating the jitter rise of each described historical traffic index data fragmentation The steps of threshold and jitter drop threshold also include the following steps: Select all historical traffic index data of each business line in the first period; Evenly divide all historical traffic index data of each selected business line according to time order to form multiple historical traffic index data fragments; A jitter value between various historical traffic index data in each historical traffic index data fragment is acquired, and a jitter rising threshold and a jitter falling threshold of the historical traffic index data fragment are generated. 3. the automatic detection method of traffic index abnormality as claimed in claim 2, it is characterized in that, when forming a plurality of historical traffic index data in described historical traffic index data slice to be normal distribution, when generating The steps of the jitter rising threshold and the jitter falling threshold of the historical traffic index data fragmentation also include the following steps: Excluding multiple historical traffic index data with the largest numerical value and historical traffic index data with the smallest numerical value in the historical traffic index data fragment; Compensate the jitter rising threshold and jitter falling threshold generated by each historical traffic index data retained in the historical traffic index data fragment, and use the compensated jitter rising threshold and jitter falling threshold respectively as the historical traffic index data fragment The chip's jitter rising threshold and jitter falling threshold. 4. the automatic detection method of traffic index abnormality as claimed in claim 3 is characterized in that, removes respectively with the ratio of 12.5% the historical traffic index data and the most numerical values in this historical traffic index data fragmentation. The historical traffic indicator data with the smallest value. 5. the abnormal automatic detection method of traffic index as claimed in claim 3 is characterized in that, the jitter rise that is generated by each historical traffic index data retained in this historical traffic index data slice is compensated with a ratio of 30% threshold and jitter drop threshold. 6. The method for automatic detection of abnormal traffic indicators according to claim 2, characterized in that the first period is 1 month or 2 months. 7. the abnormal automatic detection method of traffic index as claimed in claim 1, it is characterized in that, this traffic index data slice to be detected is carried out local trend verification, calculates mean value, and according to this word to be detected The conditions for selecting the second reasonable data range for the jitter range of service index data fragmentation are: Two consecutive jitter values respectively exceed twice the jitter rising threshold or jitter falling threshold of the historical traffic index data slice; or Three consecutive jitter values exceed 1.8 times the jitter rising threshold or jitter falling threshold of the historical traffic index data slice respectively. 8. the abnormal automatic detection method of traffic index as claimed in claim 1 is characterized in that, the traffic index data of preservation and the total number of a plurality of traffic index data near the traffic index data to be detected and the pending traffic index data The total number of historical traffic index data in the historical traffic index data slices of the service line corresponding to the detected traffic index data is the same. 9. The method for automatic detection of traffic index abnormalities according to any one of claims 1 to 8, characterized in that, each traffic index data collected and stored is all data in a second period of time sum or average of . 10. The method for automatically detecting traffic index abnormalities as claimed in claim 9, characterized in that, in each service line, the second time period selected for each traffic index data collected and stored is the same, and the first The second time period is any one of 1 minute, 2 minutes, 5 minutes or 30 minutes. 11. An automatic detection device for abnormal traffic indicators, characterized in that, the automatic detection device for abnormal traffic indicators includes: Data collection module, used to collect traffic index data of each business line; A storage module, connected to the data acquisition module, for storing the collected traffic index data of each business line; The jitter analysis module is connected with the storage module, and is used to form a plurality of historical traffic index data fragments according to the time dimension of the stored historical traffic index data of each business line, and generate each of the historical traffic index data. The jitter rising threshold and jitter falling threshold of service indicator data fragmentation; The jitter detection module is connected to the jitter analysis module and the acquisition module respectively, and is used to determine the Whether the traffic index data is abnormal data; An alarm module, connected to the jitter detection module, used to notify the responsible person of the business line after processing according to the alarm content of the business line where the traffic index data is located when the traffic index data is detected as abnormal data object; The shake detection module includes: The local data storage unit is used to save the traffic index data to be detected and a plurality of continuous traffic index data in its vicinity to form a segment of the traffic index data to be detected; A jitter value calculation unit, connected to the local data storage unit, for obtaining the jitter value between each traffic index data in the traffic index data slice to be detected; The jitter threshold acquisition unit is connected to the local data storage unit, and is used to obtain the jitter rising threshold of the corresponding historical traffic index data fragment according to the business line to which the traffic index data to be detected belongs and the time period. and jitter drop threshold; A jitter rule acquisition unit, connected to the local data storage unit, the local data storage unit, and the jitter value calculation unit, for when the multiple consecutive jitter values in the traffic index data fragment to be detected exceed In the first reasonable value range, carry out local trend verification to the traffic index data fragmentation to be detected, calculate the average value, and select a second reasonable value range according to the jitter range of the traffic index data fragmentation to be detected , wherein the maximum value of the first reasonable value range is greater than the jitter rising threshold of the historical traffic index data fragmentation, and the minimum value is less than the falling threshold of the historical traffic index data fragmentation; The detection unit is connected with the jitter rule acquisition unit, and when the traffic index data to be detected exceeds the second reasonable value range, regards the traffic index data to be detected as abnormal data. 12. The automatic detection device of traffic index abnormality as claimed in claim 11, is characterized in that, described jitter analysis module comprises: A data selection unit, configured to select all historical traffic index data of each business line in the first period of time; The data fragmentation unit is connected with the data selection unit, and is used to evenly divide all historical traffic index data of each selected business line according to time order to form a plurality of historical traffic index data fragments; Threshold calculation unit, connected with the data fragmentation unit, used to obtain the jitter value between each historical traffic index data in each historical traffic index data fragmentation, and generate the historical traffic index data fragmentation Jitter Rising Threshold and Jitter Falling Threshold. 13. The automatic detection device of traffic index abnormality as claimed in claim 12, is characterized in that, when described data fragmentation unit forms a plurality of historical traffic index data in the fragmentation of described historical traffic index data to be positive When the state distribution, the threshold calculation unit also includes: A data elimination unit for eliminating a plurality of historical traffic index data with the largest numerical value and a plurality of historical traffic index data with the smallest numerical value in the historical traffic index data fragment; and The data correction unit is connected with the data elimination unit, and is used to compensate the jitter rising threshold and the jitter falling threshold generated by each historical traffic index data retained in the historical traffic index data slice, and the compensated jitter The rising threshold and the jitter falling threshold are respectively used as the jitter rising threshold and the jitter falling threshold of the historical traffic index data slice. 14. A terminal device, comprising: processor; and a memory storing a program, wherein, when the processor executes the program, the following operations are performed: Collect traffic index data of each business line; Store the collected traffic index data of each business line; Forming a plurality of historical traffic index data fragments according to the time dimension of the stored historical traffic index data of each business line, and generating a jitter rising threshold and a jitter falling threshold for each of the historical traffic index data fragments; Judging whether the traffic index data is abnormal data according to the jitter rising threshold and the jitter falling threshold of the historical traffic index data fragmentation corresponding to the traffic index data to be detected; When the traffic index data is detected as abnormal data, after processing according to the alarm content of the business line where the traffic index data is located, notify the responsible object of the business line; The step of judging whether the traffic index data is abnormal data also includes the following steps: saving the traffic index data to be detected and a plurality of continuous traffic index data in its vicinity to form a segment of the traffic index data to be detected; Obtain the jitter value between each traffic index data in the traffic index data fragment to be detected; According to the business line to which the traffic index data to be detected belongs and the time period, the jitter rising threshold and the jitter falling threshold of the corresponding historical traffic index data fragmentation are obtained; When the continuous multiple jitter values in the traffic index data fragments to be detected exceed the first reasonable value range, then the traffic index data fragments to be detected are checked for local trends, the average value is calculated, and according to The jitter range of the traffic index data fragmentation to be detected selects a second reasonable value range, wherein, the maximum value of the first reasonable value range is greater than the jitter rising threshold of the historical traffic index data fragmentation, and the minimum value is less than the historical traffic The falling threshold of indicator data sharding; If the traffic index data to be detected exceeds the second reasonable value range, the traffic index data to be detected is regarded as abnormal data. 15. A storage medium for storing a program, wherein, when the program is executed, the terminal device performs the following operations: Collect traffic index data of each business line; Store the collected traffic index data of each business line; Forming a plurality of historical traffic index data fragments according to the time dimension of the stored historical traffic index data of each business line, and generating a jitter rising threshold and a jitter falling threshold for each of the historical traffic index data fragments; Judging whether the traffic index data is abnormal data according to the jitter rising threshold and the jitter falling threshold of the historical traffic index data fragmentation corresponding to the traffic index data to be detected; When the traffic index data is detected as abnormal data, after processing according to the alarm content of the business line where the traffic index data is located, notify the responsible object of the business line; The step of judging whether the traffic index data is abnormal data also includes the following steps: saving the traffic index data to be detected and a plurality of continuous traffic index data in its vicinity to form a segment of the traffic index data to be detected; Obtain the jitter value between each traffic index data in the traffic index data fragment to be detected; According to the business line to which the traffic index data to be detected belongs and the time period, the jitter rising threshold and the jitter falling threshold of the corresponding historical traffic index data fragmentation are obtained; When the continuous multiple jitter values in the traffic index data fragments to be detected exceed the first reasonable value range, then the traffic index data fragments to be detected are checked for local trends, the average value is calculated, and according to The jitter range of the traffic index data fragmentation to be detected selects a second reasonable value range, wherein, the maximum value of the first reasonable value range is greater than the jitter rising threshold of the historical traffic index data fragmentation, and the minimum value is less than the historical traffic The falling threshold of indicator data sharding; If the traffic index data to be detected exceeds the second reasonable value range, the traffic index data to be detected is regarded as abnormal data.